Privacy Policy
Last updated: September 5, 2026
The short version. We collect what the product needs to work. We do not sell your data, we do not run advertising, and analytics cookies are only set if you press Accept. You can export everything we hold and delete your account yourself, from your dashboard, without asking us.
Who is responsible for your data
The data controller is SIA 2A2M, a limited liability company (SIA) registered in the Republic of Latvia, which operates ShipShelf. For any privacy request or question, contact privacy@shipshelf.co.
What we collect
Because you gave it to us
Your name, email address and a bcrypt hash of your password (never the password itself). Anything you choose to add to your profile — bio, avatar, website, social handle — and everything you publish: listings, logos and screenshots, reviews, comments, collections and build-log updates.
Because the service generates it
Upvotes and karma events, notifications, listing view counts, outbound click counts, and rank snapshots. Single-use tokens for password resets and email confirmation, stored only as SHA-256 hashes.
To keep rankings honest
A keyed hash of your IP address at sign-up and when you vote. It is not reversible into an address; it exists so that one person cannot quietly run ten accounts to upvote themselves. We do not keep raw IP addresses in the application database.
If you buy something
Priority Launch is paid for on Stripe's checkout page, not ours. Stripe collects your card details and billing address and tells us only what we need to fulfil the purchase: that it succeeded, the amount, your email address, and a Stripe reference. We keep a payment record — who, what listing, how much, when, and that reference — and a note that you acknowledged the start of the service before paying. We never receive or store a card number.
If you accept analytics
Aggregate usage data through Google Analytics 4 — pages viewed, approximate region, device type, and how you arrived. Google truncates IP addresses before storage. The Google tag is not loaded until you accept, so if you decline nothing is requested from Google, nothing is collected, and no analytics cookie is set.
Why we process it, and our legal basis
To perform our contract with you (Article 6(1)(b) GDPR): running the account you signed up for, publishing your listings and reviews under your profile, and sending service email such as password resets and moderation outcomes. This email is not marketing and cannot be unsubscribed from while your account exists.
Our legitimate interests (Article 6(1)(f)): preventing spam, vote manipulation and account abuse; keeping the leaderboard meaningful; and keeping the service secure. We use the least identifying data that works, which is why addresses are hashed rather than stored.
A legal obligation (Article 6(1)(c)): keeping records of payments for as long as Latvian accounting law requires, which is why payment records survive the deletion of the account that made them.
Your consent (Article 6(1)(a)): the weekly digest, which requires you to confirm your address by email before anything is sent and carries a one-click unsubscribe in every issue; and analytics cookies, which are denied until you accept. You can withdraw either at any time without affecting anything else.
How long we keep it
Account data and published content are kept until you delete them or close your account. Analytics events, notifications and rank snapshots are deleted automatically after 90 days. Password-reset and confirmation tokens expire within hours and the rows are swept within a day of use. Newsletter records are kept while you are subscribed, and an unsubscribe is retained so we can honour it. Payment records are kept for five years after the year of the transaction, as the Latvian Law on Accounting requires, even if you delete your account in the meantime. Google Analytics data is retained on Google's systems for 14 months.
Who else processes it
We do not sell personal data and we do not share it for advertising. These processors act on our instructions under a data processing agreement:
| Processor | What they do | Where |
|---|---|---|
| MongoDB Atlas | Database hosting — accounts, listings, reviews, notifications | European Union (Frankfurt) |
| DigitalOcean | Application server and uploaded images | European Union (Frankfurt) |
| Brevo (Sendinblue) | Sending transactional email and the weekly digest | European Union (France) |
| Stripe Payments Europe, Ltd. | Payment processing for Priority Launch — your card details go to Stripe directly and never reach our servers | European Union (Ireland); Stripe, Inc. in the United States under Stripe's Standard Contractual Clauses |
| Vimeo / Loom | Only on a listing whose maker embedded a demo video: the player loads from their servers when the page opens and may set their own cookies. YouTube embeds use the no-cookie domain | United States (each under its own privacy policy) |
| Google Analytics 4 | Aggregate usage measurement — only after you accept analytics cookies | United States (see International transfers) |
International transfers
Your account data and everything you publish stay on servers in the European Union. If you accept analytics cookies, Google Analytics may transfer aggregate usage data to the United States. Google relies on the EU–US Data Privacy Framework and on the European Commission's Standard Contractual Clauses for that transfer. Declining analytics avoids the transfer entirely.
Cookies
We use as few as the product can function with. There are no advertising cookies and no cross-site tracking by us. The one third party that can set a cookie on a page here is a maker's embedded demo video (Vimeo or Loom), from its own domain.
| Cookie | Purpose | Lifetime | Basis |
|---|---|---|---|
| shipshelf_session | Keeps you logged in. httpOnly, SameSite=Lax, set only after you sign in. | 30 days | Strictly necessary — no consent required |
| shipshelf:consent · shipshelf:motion · shipshelf:motion-invite | Browser local storage, not cookies: your analytics choice, your reduced-motion preference, and that you have seen the motion prompt. Never sent to any server. | Until you clear it, or use Cookie settings | Strictly necessary — no consent required |
| _ga, _ga_* | Google Analytics: distinguishes visitors so page counts are not double-counted. | Up to 2 years | Only set if you press Accept |
Stripe's checkout page runs on stripe.com and sets its own cookies there, under Stripe's privacy policy; it sets none on shipshelf.co.
Analytics stay switched off until you press Accept. To change your mind later, use “Cookie settings” in the footer: it removes Google's cookies, forgets your choice and asks again — without signing you out or touching anything else.
Your rights
Under the GDPR you have the right to access, correct, delete, export and restrict processing of your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time.
Two of these you can exercise immediately, without contacting anyone: download a portable copy of everything we hold from your dashboard (“Download my data”), and delete your account and its content from the same page. For anything else, write to privacy@shipshelf.co and we will respond within one month.
If you believe we have handled your data improperly you may complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or to the supervisory authority where you live.
Your controls
Edit or delete your listings at any time from the dashboard, and delete your whole account — with everything attached — from the dashboard's Danger zone. Payment records are the one exception, kept for the accounting period described above. Comments that others replied to remain as anonymous “Deleted user” placeholders so the conversation still reads. Every digest carries a one-click unsubscribe, and you can mute categories of notification from your dashboard; moderation outcomes are transactional and always delivered.
Security
Passwords are hashed with bcrypt and never stored or logged in the clear. The site is served over HTTPS only, with a strict Content Security Policy. Uploaded files are validated by content rather than filename and served from an isolated path. Password-reset links are stored as hashes, expire within an hour and work once — a copy of our database cannot be replayed into an account takeover.
Children
ShipShelf is intended for people building and evaluating software products and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has created an account, write to us and we will remove it.
Changes to this policy
We update this page when what we do changes — a new processor, a new category of data. The date at the top always reflects the current version, and material changes are announced in the product.